Subject: Re: Hi

From: [email-masked] (Noel Chiappa)
Date: Mon, 19 Jan 2004 10:53:18 -0500 (EST)

> From: John Stracke <[email-masked]>

    > I didn't write that; the return address was faked.

So much for mailing list "security" by only allowing posts from subscribers.

This virus/worm is actually mildly interested in the way it operates. I'm
seeing lots of email from people with whom I would have corresponded long ago.
So it's probably mining web pages for old email, and using the addresses it
finds in the headers as source/dest pairs.

I wonder how long it will take before the spammers catch onto this trick.

	Noel

---

From: [email-masked]
Date: Mon, 19 Jan 2004 11:20:45 -0500

On Mon, 19 Jan 2004 10:53:18 EST, Noel Chiappa said:

> seeing lots of email from people with whom I would have corresponded long ago

From http://www.viruslist.com/eng/alert.html?id=783050:

The worm searches disk drives for files with the following extensions:

wab, txt, htm, html, r1

and scans them for email-like text strings, then sends infected messages to the
email addresses found. The worm uses its own SMTP engine to send infected
messages.

> finds in the headers as source/dest pairs.

Old notebooks, but you're on the right track.

> I wonder how long it will take before the spammers catch onto this trick.

They already have.  Somebody on the NANOG list is infected with something that
takes the RFC822 headers of incoming mail and glues them onto a spam.  I found
this when I got a "sensitive content" warning 8 minutes after I posted to NANOG.
The victim site's filter coughed up the from/to/subject - but by the time it had
gotten there, the body had mutated into an ad for a male enhancement pill.

The clever part here is that since it's using near-in-real-time headers from
actual discussions, there's a very good chance that the spam recipient will
open it, thinking it's the ongoing discussion....

---

From: [email-masked]
Date: Mon, 19 Jan 2004 08:52:36 -0800

> So much for mailing list "security" by only allowing posts from subscribers.

Security is not a binary condition.  

> finds in the headers as source/dest pairs.

Perhaps, but that would be pretty impressive for a 16K executable --
maybe it downloads a second stage  -- there are a bunch of builtin urls,
eg:

http://www.elrasshop.de/1.php
http://www.it-msc.de/1.php
http://www.getyourfree.net/1.php
http://www.dmdesign.de/1.php
http://64.176.228.13/1.php
http://www.leonzernitsky.com/1.php
http://216.98.136.248/1.php
http://216.98.134.247/1.php
http://www.cdromca.com/1.php
http://www.kunst-in-templin.de/1.php
http://vipweb.ru/1.php
http://antol-co.ru/1.php
http://www.bags-dostavka.mags.ru/1.php
http://www.5x12.ru/1.php
http://bose-audio.net/1.php
http://www.sttngdata.de/1.php
http://wh9.tu-dresden.de/1.php
http://www.micronuke.net/1.php
http://www.stadthagen.org/1.php
etc

-- 
Kent Crispin 
[email-masked]    p: +1 310 823 9358  f: +1 310 823 8649
[email-masked] SIP: [email-masked]